Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 31b962b

Browse files
IgorEulalioIgorEulalio
committedFeb 4, 2025·
Merge branch 'feat/add-process-based-exceptions-to-drift-policies' of https://github.com/sysdiglabs/terraform-provider-sysdig into feat/add-process-based-exceptions-to-drift-policies
2 parents 5668f0a + 1c57569 commit 31b962b

14 files changed

+1140
-1719
lines changed
 

‎examples/serverless-agent/fargate/workload-legacy/README.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Workload with Serverless Workload Agent
2+
3+
This example deploys a cluster with a workload and the Serverless Workload Agent as a sidecar to secure the workload.
4+
5+
The Workload Agent will use an Orchestrator Agent as a proxy to the Sysdig Collector.
6+
7+
## Prerequisites
8+
9+
The following prerequisites are required to deploy this cluster:
10+
- Orchestrator Agent deployed
11+
- VPC
12+
- 2 subnets
13+
14+
## Components
15+
16+
The cluster will be called `<prefix>-instrumented-workload` and will deploy the following:
17+
- 1 Service (called `<prefix-instrumented-service`)
18+
- 1 Task with 2 replicas, each running:
19+
- 1 container named `event-gen-1` running `falcosecurity/event-generator`
20+
- 1 container named `event-gen-2` also running `falcosecurity/event-generator`
21+
- 1 container named `SysdigInstrumentation` running the latest Workload Agent which will secure both workload containers
22+
23+
## Layout
24+
| **File** | **Purpose** |
25+
| --- | --- |
26+
| `instrumented_load.tf` | Workload definition. By default it instruments `falcosecurity/event-generator` |
27+
| `main.tf` | AWS provider configuration |
28+
| `output.tf` | Defines the output variables |
29+
| `variables.tf` | AWS and Agent configuration |
30+
| `versions.tf` | Defines TF provider versions |

‎examples/serverless-agent/fargate/workload-legacy/instrumented_load.tf

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
data "sysdig_fargate_workload_agent" "containers_instrumented" {
2+
container_definitions = jsonencode([
3+
{
4+
"name" : "event-gen-1",
5+
"image" : "falcosecurity/event-generator",
6+
"command" : ["run", "syscall", "--all", "--loop"],
7+
"logConfiguration" : {
8+
"logDriver" : "awslogs",
9+
"options" : {
10+
"awslogs-group" : aws_cloudwatch_log_group.instrumented_logs.name,
11+
"awslogs-region" : var.region,
12+
"awslogs-stream-prefix" : "task"
13+
},
14+
}
15+
},
16+
{
17+
"name" : "event-gen-2",
18+
"image" : "falcosecurity/event-generator",
19+
"command" : ["run", "syscall", "--all", "--loop"],
20+
"logConfiguration" : {
21+
"logDriver" : "awslogs",
22+
"options" : {
23+
"awslogs-group" : aws_cloudwatch_log_group.instrumented_logs.name,
24+
"awslogs-region" : var.region,
25+
"awslogs-stream-prefix" : "task"
26+
},
27+
}
28+
}
29+
])
30+
31+
workload_agent_image = var.agent_workload_image
32+
33+
sysdig_access_key = var.access_key
34+
orchestrator_host = var.orchestrator_host
35+
orchestrator_port = var.orchestrator_port
36+
37+
log_configuration {
38+
group = aws_cloudwatch_log_group.instrumented_logs.name
39+
stream_prefix = "instrumentation"
40+
region = var.region
41+
}
42+
}
43+
44+
resource "aws_ecs_task_definition" "task_definition" {
45+
family = "${var.prefix}-instrumented-task-definition"
46+
task_role_arn = aws_iam_role.task_role.arn
47+
execution_role_arn = aws_iam_role.execution_role.arn
48+
49+
cpu = "256"
50+
memory = "512"
51+
network_mode = "awsvpc"
52+
requires_compatibilities = ["FARGATE"]
53+
pid_mode = "task"
54+
55+
container_definitions = data.sysdig_fargate_workload_agent.containers_instrumented.output_container_definitions
56+
}
57+
58+
59+
resource "aws_ecs_cluster" "cluster" {
60+
name = "${var.prefix}-instrumented-workload"
61+
}
62+
63+
resource "aws_cloudwatch_log_group" "instrumented_logs" {
64+
}
65+
66+
data "aws_iam_policy_document" "assume_role_policy" {
67+
statement {
68+
actions = ["sts:AssumeRole"]
69+
70+
principals {
71+
type = "Service"
72+
identifiers = ["ecs-tasks.amazonaws.com"]
73+
}
74+
}
75+
}
76+
77+
resource "aws_iam_role" "execution_role" {
78+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
79+
80+
managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
81+
}
82+
83+
resource "aws_iam_role" "task_role" {
84+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
85+
86+
inline_policy {
87+
name = "root"
88+
policy = data.aws_iam_policy_document.task_policy.json
89+
}
90+
}
91+
92+
data "aws_iam_policy_document" "task_policy" {
93+
statement {
94+
actions = [
95+
"ecr:GetAuthorizationToken",
96+
"ecr:BatchCheckLayerAvailability",
97+
"ecr:GetDownloadUrlForLayer",
98+
"ecr:BatchGetImage",
99+
"logs:CreateLogGroup",
100+
"logs:CreateLogStream",
101+
"logs:PutLogEvents",
102+
]
103+
104+
resources = ["*"]
105+
}
106+
}
107+
108+
resource "aws_ecs_service" "service" {
109+
name = "${var.prefix}-instrumented-service"
110+
111+
cluster = aws_ecs_cluster.cluster.id
112+
task_definition = aws_ecs_task_definition.task_definition.arn
113+
desired_count = var.replicas
114+
launch_type = "FARGATE"
115+
platform_version = "1.4.0"
116+
117+
network_configuration {
118+
subnets = [var.subnet_1, var.subnet_2]
119+
security_groups = [aws_security_group.security_group.id]
120+
assign_public_ip = true
121+
}
122+
}
123+
124+
resource "aws_security_group" "security_group" {
125+
description = "${var.prefix}-security-group"
126+
vpc_id = var.vpc_id
127+
}
128+
129+
resource "aws_security_group_rule" "orchestrator_agent_ingress_rule" {
130+
type = "ingress"
131+
protocol = "tcp"
132+
from_port = 0
133+
to_port = 0
134+
cidr_blocks = ["0.0.0.0/0"]
135+
security_group_id = aws_security_group.security_group.id
136+
}
137+
138+
resource "aws_security_group_rule" "orchestrator_agent_egress_rule" {
139+
type = "egress"
140+
protocol = "all"
141+
from_port = 0
142+
to_port = 0
143+
cidr_blocks = ["0.0.0.0/0"]
144+
security_group_id = aws_security_group.security_group.id
145+
}

‎examples/serverless-agent/fargate/workload-legacy/output.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
output "workload_cluster_name" {
2+
value = aws_ecs_cluster.cluster.name
3+
}
4+
5+
output "workload_cluster_arn" {
6+
value = aws_ecs_cluster.cluster.arn
7+
}
8+
9+
output "service_arn" {
10+
value = aws_ecs_service.service.id
11+
}
12+
13+
output "task_revision" {
14+
value = aws_ecs_task_definition.task_definition.revision
15+
}

‎examples/serverless-agent/fargate/workload-legacy/providers.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "aws" {
2+
region = var.region
3+
profile = var.profile
4+
}

‎examples/serverless-agent/fargate/workload-legacy/variables.tf

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# AWS configuration
2+
variable "prefix" {
3+
description = "All resources created by Terraform have this prefix prepended to them"
4+
}
5+
6+
variable "profile" {
7+
description = "AWS profile name"
8+
type = string
9+
}
10+
11+
variable "region" {
12+
description = "AWS Region for deployment"
13+
default = "us-east-1"
14+
}
15+
16+
variable "subnet_1" {
17+
description = "Subnet-1 Id"
18+
}
19+
20+
variable "subnet_2" {
21+
description = "Subnet-2 Id"
22+
}
23+
24+
variable "vpc_id" {
25+
description = "VPC Id"
26+
}
27+
28+
variable "tags" {
29+
type = map(string)
30+
description = "Tags to assign to resources in module"
31+
default = {}
32+
}
33+
34+
variable "replicas" {
35+
description = "Number of workload replicas to run"
36+
default = 2
37+
}
38+
39+
# Serverless Agent Configuration
40+
variable "access_key" {
41+
description = "Sysdig Agent access key"
42+
}
43+
44+
variable "agent_workload_image" {
45+
description = "Workload agent container image"
46+
default = "quay.io/sysdig/workload-agent:latest"
47+
}
48+
49+
variable "orchestrator_host" {
50+
description = "Orchestrator Host"
51+
}
52+
53+
variable "orchestrator_port" {
54+
description = "Orchestrator Port"
55+
default = 6667
56+
}

‎examples/serverless-agent/fargate/workload-legacy/versions.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">=1.7.2"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 5.35.0"
8+
}
9+
local = {
10+
source = "hashicorp/local"
11+
version = "~> 2.4.1"
12+
}
13+
sysdig = {
14+
source = "sysdiglabs/sysdig"
15+
version = "~> 1.24.5"
16+
}
17+
}
18+
}

‎examples/serverless-agent/fargate/workload/README.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,22 @@
22

33
This example deploys a cluster with a workload and the Serverless Workload Agent as a sidecar to secure the workload.
44

5+
The Workload Agent will directly connect to the Sysdig Collector.
6+
57
## Prerequisites
68

79
The following prerequisites are required to deploy this cluster:
8-
- Orchestrator Agent deployed
910
- VPC
1011
- 2 subnets
1112

1213
## Components
1314

1415
The cluster will be called `<prefix>-instrumented-workload` and will deploy the following:
1516
- 1 Service (called `<prefix-instrumented-service`)
16-
- 1 Task (with the latest version of the Serverless Orchestrator Agent)
17+
- 1 Task with 2 replicas, each running:
1718
- 1 container named `event-gen-1` running `falcosecurity/event-generator`
1819
- 1 container named `event-gen-2` also running `falcosecurity/event-generator`
19-
- 1 container named `SysdigInstrumentation` running the Workload Agent which will secure both workload containers
20+
- 1 container named `SysdigInstrumentation` running the latest Workload Agent which will secure both workload containers
2021

2122
## Layout
2223
| **File** | **Purpose** |

‎examples/serverless-agent/fargate/workload/instrumented_load.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ data "sysdig_fargate_workload_agent" "containers_instrumented" {
3131
workload_agent_image = var.agent_workload_image
3232

3333
sysdig_access_key = var.access_key
34-
orchestrator_host = var.orchestrator_host
35-
orchestrator_port = var.orchestrator_port
34+
collector_host = var.collector_host
35+
collector_port = var.collector_port
3636

3737
log_configuration {
3838
group = aws_cloudwatch_log_group.instrumented_logs.name

‎examples/serverless-agent/fargate/workload/variables.tf

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ variable "tags" {
3131
default = {}
3232
}
3333

34+
variable "replicas" {
35+
description = "Number of workload replicas to run"
36+
default = 2
37+
}
38+
3439
# Serverless Agent Configuration
3540
variable "access_key" {
3641
description = "Sysdig Agent access key"
@@ -41,16 +46,11 @@ variable "agent_workload_image" {
4146
default = "quay.io/sysdig/workload-agent:latest"
4247
}
4348

44-
variable "orchestrator_host" {
45-
description = "Orchestrator Host"
49+
variable "collector_host" {
50+
description = "Collector Host"
4651
}
4752

48-
variable "orchestrator_port" {
49-
description = "Orchestrator Port"
50-
default = 6667
51-
}
52-
53-
variable "replicas" {
54-
description = "Number of workload replicas to run"
55-
default = 2
53+
variable "collector_port" {
54+
description = "Collector Port"
55+
default = 6443
5656
}

‎sysdig/data_source_sysdig_monitor_notification_channel_ibm_function_test.go

Lines changed: 0 additions & 54 deletions
This file was deleted.

‎sysdig/internal/client/v2/cloudauth/go/cloud_account.pb.go

Lines changed: 843 additions & 1517 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sysdig/resource_sysdig_monitor_notification_channel_ibm_cloud_function_test.go

Lines changed: 0 additions & 122 deletions
This file was deleted.

‎sysdig/resource_sysdig_secure_cloud_auth_account_test.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -754,10 +754,11 @@ resource "sysdig_secure_cloud_auth_account" "sample" {
754754
oci = {
755755
api_key = {
756756
user_id = "user-id"
757+
# region = "region"
758+
}
759+
policy = {
760+
policy_id = "policy-id"
757761
}
758-
# policy = {
759-
# policy_id = "policy-id"
760-
# }
761762
}
762763
})
763764
}

‎website/docs/d/fargate_workload_agent.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,32 +8,33 @@ description: |-
88

99
# Data Source: fargate_workload_agent
1010

11-
Updates the fargate workload definition to add a [Sysdig Agent](https://docs.sysdig.com/en/docs/installation/serverless-agents/aws-fargate-serverless-agents/)
11+
Updates the ECS Fargate Container Definitions to add a [Sysdig Workload Agent](https://docs.sysdig.com/en/docs/installation/serverless-agents/aws-fargate-serverless-agents/)
1212

1313
-> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository.
1414

15-
You'll need to connect the Sysdig Agent to the Sysdig backend through an orchestrator. For details about how to deploy an orchestrator check the [Sysdig Orchestrator module](https://registry.terraform.io/modules/sysdiglabs/fargate-orchestrator-agent/aws/latest).
15+
The Sysdig Workload Agent will need to connect to the Sysdig Collector. Find your region's collector endpoint here: https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/.
1616

1717
## Example Usage
1818

1919
```terraform
2020
data "sysdig_fargate_workload_agent" "instrumented_containers" {
2121
container_definitions = "[]"
2222
23-
image_auth_secret = ""
2423
workload_agent_image = "quay.io/sysdig/workload-agent:latest"
25-
26-
orchestrator_host = module.fargate-orchestrator-agent.orchestrator_host
27-
orchestrator_port = module.fargate-orchestrator-agent.orchestrator_port
24+
25+
collector_host = var.collector_host
26+
collector_port = var.collector_port
27+
sysdig_access_key = var.sysdig_access_key
2828
}
2929
```
3030

3131
## Argument Reference
3232

3333
* `container_definitions` - (Required) The input Fargate container definitions to instrument with the Sysdig workload agent.
34-
* `orchestrator_host` - (Required) The orchestrator host to connect to.
35-
* `orchestrator_port` - (Required) The orchestrator port to connect to.
3634
* `workload_agent_image` - (Required) The Sysdig workload agent image.
35+
* `collector_host` - (Required) The Sysdig Collector host to connect to.
36+
* `collector_port` - (Required) The Sysdig Collector port.
37+
* `sysdig_access_key` - (Required) The Sysdig Agent access key, available in the Sysdig Secure UI.
3738
* `image_auth_secret` - (Optional) The registry authentication secret.
3839
* `log_configuration` - (Optional) Configuration for the awslogs driver on the instrumentation container. All three values must be specified if instrumentation logging is desired:
3940
* `group` - The name of the existing log group for instrumentation logs

0 commit comments

Comments
 (0)
Please sign in to comment.